Index: head/Mk/bsd.gecko.mk
===================================================================
--- head/Mk/bsd.gecko.mk
+++ head/Mk/bsd.gecko.mk
@@ -119,11 +119,6 @@
 MOZ_OPTIONS+=	--enable-pie
 .endif
 
-.if ${MOZILLA_VER:R:R} >= 65
-# Let vendor add -fstack-protector-strong on all architectures
-SSP_UNSAFE=		yes
-.endif
-
 MOZILLA_SUFX?=	none
 MOZSRC?=	${WRKSRC}
 PLISTF?=	${WRKDIR}/plist_files
Index: head/Mk/bsd.ssp.mk
===================================================================
--- head/Mk/bsd.ssp.mk
+++ head/Mk/bsd.ssp.mk
@@ -4,14 +4,9 @@
 SSP_Include_MAINTAINER=	portmgr@FreeBSD.org
 
 .if !defined(SSP_UNSAFE) && \
-    (${ARCH} == i386 || ${ARCH} == amd64)
+    (${MACHINE} != "mips")
 # Overridable as a user may want to use -fstack-protector-all
-SSP_CFLAGS?=	-fstack-protector
+SSP_CFLAGS?=	-fstack-protector-strong
 CFLAGS+=	${SSP_CFLAGS}
-LDFLAGS+=	-fstack-protector
-# -lssp_nonshared is needed on i386 where /usr/lib/libc.so is not an ldscript
-# This is currently unused XXX
-.	if defined(SSP_NEED_NONSHARED)
-LDFLAGS+=	-lssp_nonshared
-.	endif
+LDFLAGS+=	${SSP_CFLAGS}
 .endif
Index: head/audio/linux-skype_oss_wrapper/Makefile
===================================================================
--- head/audio/linux-skype_oss_wrapper/Makefile
+++ head/audio/linux-skype_oss_wrapper/Makefile
@@ -24,6 +24,7 @@
 USE_LINUX=	base devtools:build
 USE_LINUX_PREFIX=	yes
 # do not define USE_LDCONFIG, it's not for global use
+SSP_CFLAGS?=	-fstack-protector # XXX -strong isn't supported by GCC < 4.9
 
 ONLY_FOR_ARCHS=	i386 amd64
 PLIST_FILES=	lib/skype_oss_wrapper/libpulse.so.0
Index: head/devel/linux_libusb/Makefile
===================================================================
--- head/devel/linux_libusb/Makefile
+++ head/devel/linux_libusb/Makefile
@@ -20,6 +20,7 @@
 			usr/lib/libusb-0.1.so.4
 CC=		${LINUXBASE}/usr/bin/gcc
 CFLAGS+=	-I${WRKDIR}/sys
+SSP_CFLAGS?=	-fstack-protector # XXX -strong isn't supported by GCC < 4.9
 MAKE_ARGS+=	LIBUSB_GLOBAL_INCLUDE_FILE=libusb_global_linux.h
 MAKE_ARGS+=	PTHREAD_LIBS="-lpthread -lrt"
 MAKE_ARGS+=	WITHOUT_SSP=yes
Index: head/devel/mingw32-libyaml/Makefile
===================================================================
--- head/devel/mingw32-libyaml/Makefile
+++ head/devel/mingw32-libyaml/Makefile
@@ -21,6 +21,7 @@
 CONFIGURE_ARGS=	--host="mingw32"
 CC=		${PKGNAMEPREFIX}gcc
 CFLAGS=		-O3	# Override CFLAGS for a cross-build
+SSP_CFLAGS?=	-fstack-protector # XXX -strong isn't supported by GCC < 4.9
 USES=		libtool
 
 .include <bsd.port.mk>
Index: head/devel/psptoolchain-gcc-stage1/Makefile
===================================================================
--- head/devel/psptoolchain-gcc-stage1/Makefile
+++ head/devel/psptoolchain-gcc-stage1/Makefile
@@ -52,6 +52,7 @@
 			--with-ld=${LOCALBASE}/bin/psp-ld \
 			--with-as=${LOCALBASE}/bin/psp-as \
 			--mandir=${PREFIX}/man
+SSP_CFLAGS?=		-fstack-protector # XXX -strong isn't supported by GCC < 4.9
 
 # Don't install any documentation for psptoolchain's gcc stage 1 - makes no sense.
 # Disable installation of .info files and libiberty for both stages.
Index: head/devel/psptoolchain-newlib/Makefile
===================================================================
--- head/devel/psptoolchain-newlib/Makefile
+++ head/devel/psptoolchain-newlib/Makefile
@@ -29,6 +29,7 @@
 			CFLAGS="${CFLAGS:C/(^|[[:space:]])-march=[^[:space:]]*//g} -g"
 MAKE_ENV=		PATH=${LOCALBASE}/${PSP_GCC_STAGE_PREFIX}/bin:${PATH}
 CONFIGURE_ARGS=		--prefix=${PREFIX} --target="psp"
+SSP_CFLAGS?=		-fstack-protector # XXX -strong isn't supported by GCC < 4.9
 
 # Disable installation of .info files and fix includedir reference.
 post-patch:
Index: head/devel/psptoolchain-pspsdk-stage2/Makefile
===================================================================
--- head/devel/psptoolchain-pspsdk-stage2/Makefile
+++ head/devel/psptoolchain-pspsdk-stage2/Makefile
@@ -18,6 +18,7 @@
 # psp-gcc doesn't need -march=... in CFLAGS (e.g. set by CPUTYPE in make.conf)
 CONFIGURE_ENV=		CFLAGS="${CFLAGS:C/(^|[[:space:]])-march=[^[:space:]]*//g}"
 CONFIGURE_ARGS=		--prefix=${PREFIX} --with-pspdev="${LOCALBASE}"
+SSP_CFLAGS?=		-fstack-protector # XXX -strong isn't supported by GCC < 4.9
 
 PLIST=			${.CURDIR}/pkg-plist
 MASTERDIR=		${.CURDIR}/../psptoolchain-pspsdk-stage1
Index: head/lang/gnu-cobol/Makefile
===================================================================
--- head/lang/gnu-cobol/Makefile
+++ head/lang/gnu-cobol/Makefile
@@ -24,6 +24,7 @@
 DATADIR=	${PREFIX}/share/gnucobol
 
 INSTALL_TARGET=	install-strip
+SSP_CFLAGS?=	-fstack-protector # XXX -strong fails to build
 CPPFLAGS+=	-I${BDB_INCLUDE_DIR} -I${LOCALBASE}/include
 LDFLAGS+=	-L${LOCALBASE}/lib
 
Index: head/lang/mlton/Makefile
===================================================================
--- head/lang/mlton/Makefile
+++ head/lang/mlton/Makefile
@@ -71,6 +71,7 @@
 		${LOCALBASE}/mingw32/lib/libgmp.a:math/mingw32-libgmp
 RUN_DEPENDS+=	mingw32-gcc:devel/mingw32-gcc \
 		${LOCALBASE}/mingw32/lib/libgmp.a:math/mingw32-libgmp
+SSP_CFLAGS?=	-fstack-protector # XXX -strong isn't supported by GCC < 4.9
 
 PLIST_SUB+=	MINGW32CROSS=""
 .else
Index: head/math/gretl/Makefile
===================================================================
--- head/math/gretl/Makefile
+++ head/math/gretl/Makefile
@@ -27,6 +27,7 @@
 
 BINARY_ALIAS=	make=${GMAKE}
 ALL_TARGET=	# empty
+SSP_CFLAGS?=	-fstack-protector # XXX -strong crashes mklang on 12.0+ i386
 CONFIGURE_ENV=	ac_cv_lib_dl_dlopen="" \
 		LAPACK_LIBS="${LAPACK} ${BLAS}"
 
Index: head/math/mingw32-libgmp/Makefile
===================================================================
--- head/math/mingw32-libgmp/Makefile
+++ head/math/mingw32-libgmp/Makefile
@@ -23,6 +23,7 @@
 CC=		${PKGNAMEPREFIX}gcc
 CXX=		${PKGNAMEPREFIX}c++
 CFLAGS+=	-I/usr/include
+SSP_CFLAGS?=	-fstack-protector # XXX -strong isn't supported by GCC < 4.9
 CONFIGURE_ENV=	MAKEINFO="${MAKEINFO} --no-split" \
 		PREFIX="${PREFIX}/${GMP_TARG}" \
 		M4="/usr/bin/m4"